Fix CI: benchmark startup and SARIF upload permissions

[BlackishGreen33]

Summary

• fix benchmark workflow server startup by using pnpm --filter web exec next start -p 3000 -H 127.0.0.1
• print /tmp/confession-web.log tail when health check timeout occurs for faster root-cause debugging
• add actions: read permission to code-scanning workflow
• gate SARIF upload on PR source to avoid permission failures on forked pull requests
• sync .kiro/steering/tech.md and AGENTS.md with the CI policy updates

Validation

• pnpm lint
• pnpm build
• pnpm test

[Copilot]

Pull request overview

This PR updates CI workflows and related documentation to fix benchmark server startup reliability and prevent SARIF upload failures due to insufficient permissions (especially on forked pull requests).

Changes:

• Update benchmark workflow to start the Next.js server via pnpm --filter web exec next start ... and print server log tail on health-check timeout.
• Update code-scanning workflow permissions and gate upload-sarif to avoid fork-PR permission failures.
• Sync CI policy documentation in AGENTS.md and .kiro/steering/tech.md.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
AGENTS.md	Documents required workflow permissions and fork-PR SARIF handling; documents benchmark startup/logging expectations.
.kiro/steering/tech.md	Mirrors CI policy updates for code-scanning permissions/gating and benchmark startup/log tail behavior.
.github/workflows/code-scanning.yml	Adds actions: read and skips SARIF upload on fork PRs (still uploads artifact).
.github/workflows/benchmark-regression.yml	Uses explicit Next.js start command with host/port and tails server logs when health check times out.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.